registry / kasookoo-click-to-call-widget / 0.1.0-beta.24
kasookoo-click-to-call-widget@0.1.0-beta.24
Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe manifest has no install-time hook; its prepublish-only script runs a build. Runtime credentials are used with the configured Kasookoo API, and the fixed telemetry destination receives correlation identifiers rather than session credentials, so the inspected behavior does not establish a malicious attack surface.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer initializes the widget; a user action starts or ends a call.
Impact
No credential disclosure to an unrelated destination or other concrete attack behavior was established.
Mechanism
The widget sends session and call requests to its configured Kasookoo base URL and sends telemetry to the fixed Kasookoo monitoring endpoint.
AI rationale
The manifest has no install-time hook; its prepublish-only script runs a build. Runtime credentials are used with the configured Kasookoo API, and the fixed telemetry destination receives correlation identifiers rather than session credentials, so the inspected behavior does not establish a malicious attack surface.
Evidence
package.jsondist/index.cjsdist/index.jsdist/kasookoo-dialer.js
Network endpoints2
sdk-test.kasookoo.aimonitoring-test.kasookoo.ai/v1/traces
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes browser and CommonJS runtime entrypoints; its only lifecycle script is a prepublish-only build.
- Session creation sends the publishable key and subject to the configured Kasookoo API. Bearer tokens are attached conditionally to API requests; calls pass through the widget’s call flow.
- Widget initialization starts telemetry to a fixed Kasookoo monitoring endpoint, where spans include request, call-trace, and user identifiers. The inspected flow does not send session tokens or passwords to that endpoint.
- The browser bundle contains corresponding session, call, and telemetry flows. Targeted searches found no eval, Function constructor, or child-process usage.
Evidence against
- Telemetry starts during widget initialization and sends correlation and user identifiers to the fixed monitoring endpoint.
Behavioral surface
EnvironmentVarsNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
4 flaggeddist/kasookoo-dialer.jsView file
1var Nr=i=>{throw TypeError(i)};var li=(i,e,t)=>e.has(i)||Nr("Cannot "+t);var en=(i,e,t)=>(li(i,e,"read from private field"),t?t.call(i):e.get(i)),tn=(i,e,t)=>e.has(i)?Nr("Cannot ad...
L2: `:case"\r":case" ":case" ":continue;default:throw Error("invalid base64 string.")}switch(s){case 0:o=r,s=1;break;case 1:t[n++]=o<<2|(r&48)>>4,o=r,s=2;break;case 2:t[n++]=(o&15)<<4|...
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/kasookoo-dialer.jsView on unpkg · L112patternName = generic_password
severity = medium
line = 12
Medium
package.jsonView file
2"name": "kasookoo-click-to-call-widget",
"version": "0.1.0-beta.24",
"description": "Framework-agnostic click-to-call widget for Kasookoo — a built-in dialer and call window that places outbound SIP/phone calls over WebRTC.",
"type": "module",
"mai
Findings
1 High4 Medium7 Low
HighSame File Env Network Executiondist/kasookoo-dialer.js
MediumSecret Patterndist/kasookoo-dialer.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
LowNo License
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to kasookoo-click-to-call-widget@0.1.0-beta.24.
See all versions of kasookoo-click-to-call-widget for other recorded verdicts.
- Review the evidence and your use of kasookoo-click-to-call-widget@0.1.0-beta.24 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.